I would highly recommend this be part of the pop up that you see when you attempt to reset a password. i.e. list what symbols and characters are required, the min and max length, the characters and symbols that are not required, etc. This is pretty standard stuff for a working app